dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118
Size

552KB
MD5

dedbca4f0b8e5a2513ad35d81d5c530f
SHA1

ab04930ca35c00ac89e5be5a578589668b21a6cc
SHA256

673c737ca462deaf72f25be84d29582d1dbfaab68b9ddb8528de519ea9a51d5c
SHA512

2c361808ddffc3e0612a605e2dcabbd5b244bbb13a6a1ad2bd1589a75d917eb7c276ea1fd8d8a266efc01ceb6f0116d3cdb25fa46e520f71a9fe0005f46d3085
SSDEEP

12288:Q9XMzS3DyFImmr8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PHo:Q9XWHr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118

Files

dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

50331ceef636d0cbf8057a87f6cd321c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

kernel32

MultiByteToWideChar
DeleteFileA
SetFileAttributesA
WideCharToMultiByte
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
GetCommandLineA
SetUnhandledExceptionFilter
OpenEventA
GetSystemDirectoryA
ExpandEnvironmentStringsA
GetShortPathNameA
GetFileAttributesA
CreateEventA
WaitForSingleObject
GetModuleFileNameA
GetTickCount
CreateFileA
WriteFile
SystemTimeToFileTime
GetStartupInfoA
LocalFileTimeToFileTime
SetFileTime
CloseHandle
MoveFileA
GetCurrentDirectoryA
GetTempPathA
GetWindowsDirectoryA
lstrcpyA
lstrlenA
SetEnvironmentVariableA
CreateDirectoryA
ExitProcess
GetLastError
GetModuleHandleA
GetProcAddress
Sleep
lstrcatA
GetProcessHeap
HeapAlloc
HeapFree
Process32Next

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_itoa
tolower
toupper
_ftol
srand
rand
free
strstr
strncpy
__CxxFrameHandler
strcmp
memcpy
wcstombs
strlen
memset
strcpy
strchr
strncat
strcat
_except_handler3
_strupr
malloc
_stricmp
_strlwr
_strrev
_strnicmp
??3@YAXPAX@Z

advapi32

GetUserNameA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
SetFileSecurityA
GetSecurityDescriptorControl
AddAce
EqualSid
GetAce
GetAclInformation
GetSecurityDescriptorDacl
LookupAccountNameA
GetFileSecurityA
ChangeServiceConfig2A
CloseServiceHandle
DeleteService
CreateServiceA
OpenSCManagerA
ControlService
StartServiceA
GetServiceDisplayNameA
GetServiceKeyNameA

user32

wsprintfA
CharNextA

netapi32

NetUserGetLocalGroups

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 368KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50331ceef636d0cbf8057a87f6cd321c

Headers

File Characteristics

Imports

shlwapi

kernel32

msvcrt

advapi32

user32

netapi32

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 164KB - Virtual size: 163KB

.rsrc Size: 368KB - Virtual size: 365KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 164KB - Virtual size: 163KB

.rsrc
Size: 368KB - Virtual size: 365KB